logstash on Ubuntu seems to log in three places (I didn't set this up so I'm not positive what isn't default), which has caused one of our nodes to fill / because the ES instance it's writing to has some index issues.

Because anything worth logging once is worth logging three times!

I got to redirect syslog to our central log server (something we've been meaning to do anyway), remove a lot of files from /var/log/logstash, and then vacuum journalctl and tell it to retain only 500MB.